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DIRECTOR OF CENTRAL INTELLIGENCE 
Security Committee 


SECOM-D-282 
29 September 1977 


MEMORANDUM FOR: Acting Deputy to the DCI for the 
Intelligence Community 


FROM ; 
airman 


SUBJECT : Community Security Needs and Problems| | 


1. [| As I leave the chairmanship of the DCI Security Committee, 
I would like to share some of my thoughts and conclusions on Intelligence 
Community security needs and problems. The needs as I see them focus on 
organization, management, and resources dedicated to Community security 
matters. 


24 |] Some particularly significant problems that I see needing 
effective resolution are: 


a.[____] Personnel Security Standards. By any reasonable 
test, persons throughout the government (and industry) should meet 
essentially the same standards for access to intelligence infor- 
mation at the same level of classification. The standards, however, 
vary widely. CIA has very stringent ones for its employees. Yet, 
CIA-generated intelligence is disseminated widely to Defense, State, 
and other agencies using lesser standards. Defense, for example 


These varying standards are based on 
concepts of wnat 1S a necessary and proper basis for 
granting clearances. A Security Committee working group is con- 
ducting a study to try to determine what is necessary and desirable 
in personnel security. The results, while primarily applicable to 
a possible revision of DCID 1/14, should give us a good basis for 
proposing better standards throughout the government for access to 
Secret and Top Secret information. But, that is easier said than 
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done. A fairly well-solidified body of opinion more concerned 

with privacy considerations and due process than with good security 
coalesced in recent years behind the proposed revision of E.0. 10450, 
which sets personnel security standards for Government employees 


- generally. I do not believe the Intelligence Community will be able 


to make its views prevail in this arena unless it can speak with a 
single voice on the subject and be supported at the policy level. 


b. [| conputer Security. I am quite concerned about the 
security of intelligence information, particularly that which is 
compartmented, in shared ADP systems accessible by persons with 
varying levels of security clearances. The multi-level mode of 
operation of such systems relies too much in my judgment on every- 
thing working exactly as it should. Computer software cannot give 
positive assurances that boundaries between different classification 
and control levels of stored/processed data cannot be violated. The 
wide variance in personnel security standards noted above suggests the 
possibility of, for example, someone in Defense cleared by a process 

obtaining access through a 
remote terminal to very sensitive CIA data stored in the system. 
Business experience with fraud and embezzlement through ADP systems 
suggests that the perpetrators are caught more by accident than by 
effective security precautions built into the equipment and its 
software. I believe there needs to be a greater concentration of 
Community effort in this area, and a single Community focal point to 
identify specific problems and devise coordinated policy to correct 
them. 


Cs i; Ponpavenehen tion: The Intelligence Community's special 
security control systems are conspicuous for their lack of central 
management and common standards. The perception of abuse in this 
area (whether or not well founded) has prompted pleas for change from 
many Community agencies. But, we are just now beginning to take 
tentative steps towards some sort of standardized procedures. A 
basic problem is that there are too many Community components involved 
in the subject. Another fundamental problem, and the one that may well 
cause the most suspicion on the part of consumers,.is that the collec- 
tors who argue the need for compartments to begin with are also the 
ones who write the implementation rules, with their programs and 
procedures subject effectually only to review by themselves. Current 
approaches to the subject favor those with a vested interest in the 
status quo. Arguments are often made for the continuation of a system 
not so much because it is currently justified, but because of history. 
The COMINT compartment, for example, is very much in need of thorough 


review and revision to — it into line with 1977 circumstances. 
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oe I believe the Security Committee as a staff support element 


for the DCT jis the logical focal point for the Community in all security 
matters. Its responsibility for such should be made explicit through charter 
revision, which should simultaneously see that the charters of collection 
committees are changed to state that their security responsibilities are 
advisory to the Security Committee. These changes would have to be accom- 
panied by resource reallocations to give the Security Committee enough. 
manpower to enable it to support the DCI's security responsibilities effect- 
ively. Current manpower authorizations essentially limit us to a collegial 
role, relying on Community agencies to provide personnel on an additional 
duty basis to chair functional subcommittees and working groups, and sometimes 
restricting us to the painfully slow evolution of a Community consensus 
before a policy can be developed or revised. With adequate manpower, we 

can serve as a meaningful support component for the DCI and the Community. 
This would involve a capability: (1) to chair with our own people the 
requisite subcommittees (compartmentation, computer security, etc.) and 
working groups (e.g., personnel security standards) and thereby control 
timetables and agenda; (2) to monitor compliance with DCI security directives 
throughout the Community; and (3) to assist Community agencies in the imple- 
mentation of security policy. I believe that failure to establish and 
properly staff a Community focal point for security could result in outside 
entities seeking to fill the vacuum. Community acceptance of andcooperation 
with any coordinating security body will be strongly influenced by the per- 
ception of independence of such body from any single Community agency. 
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25X1 4. [ ] The above comments notwithstanding, the Security Committee 
has made some significant accomplishments. However, much remains to be 
done. : 
25X1 
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